Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add saajunaid/caddis-plugin --skill pythongit clone --depth 1 https://github.com/saajunaid/caddis-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/saajunaid/caddis-plugin/python)<a href="https://agentmods.dev/skills/saajunaid/caddis-plugin/python"><img src="https://agentmods.dev/badge/skills/saajunaid/caddis-plugin/python/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/saajunaid/caddis-plugin/python"><img src="https://agentmods.dev/badge/skills/saajunaid/caddis-plugin/python.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.02421 |
| Opus 5.5 | $0.00014 | $0.00968 |
| Sonnet 5.5 | $0.00007 | $0.00484 |
| Haiku 4.5 | $0.00004 | $0.00242 |
Grade A, and why
python-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 29d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 388 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Python Development
Project Setup
Modern Python Project Structure
my-project/
├── src/
│ └── my_project/
│ ├── __init__.py
│ ├── main.py
│ └── utils.py
├── tests/
│ ├── __init__.py
│ └── test_main.py
├── pyproject.toml
├── README.md
└── .gitignore
pyproject.toml
[project]
name = "my-project"
version = "0.1.0"
requires-python = ">=3.12"
dependencies = [
"fastapi>=0.100.0",
"pydantic>=2.0",
]
[project.optional-dependencies]
dev = [
"pytest>=7.0",
"ruff>=0.1.0",
"mypy>=1.0",
]
[tool.ruff]
line-length = 88
select = ["E", "F", "I", "N", "W"]
[tool.mypy]
strict = true
Type Hints
from typing import TypeVar, Generic
from collections.abc import Sequence
T = TypeVar('T')
def process_items(items: Sequence[str]) -> list[str]:
return [item.upper() for item in items]
class Repository(Generic[T]):
def get(self, id: int) -> T | None: ...
def save(self, item: T) -> T: ...
Async Patterns
import asyncio
from collections.abc import AsyncIterator
async def fetch_all(urls: list[str]) -> list[dict]:
async with aiohttp.ClientSession() as session:
tasks = [fetch_one(session, url) for url in urls]
return await asyncio.gather(*tasks)
async def stream_data() -> AsyncIterator[bytes]:
async with aiofiles.open('large_file.txt', 'rb') as f:
async for chunk in f:
yield chunk
FastAPI Patterns
from fastapi import FastAPI, Depends, HTTPException
from pydantic import BaseModel
app = FastAPI()
class UserCreate(BaseModel):
email: str
name: str
class UserResponse(BaseModel):
id: int
email: str
name: str
@app.post("/users", response_model=UserResponse)
async def create_user(
user: UserCreate,
db: Database = Depends(get_db)
) -> UserResponse:
result = await db.users.create(user.model_dump())
return UserResponse(**result)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 29d ago Changed · -4 tokens per session bd82084464ac
- 1mo ago First seen · 388 lines · 40 tokens per session scan A 7e2bcfd7560c
python-development is a skill published in the GitHub repository saajunaid/caddis-plugin (0 stars, last pushed 2d ago), licensed MIT. It adds 36 tokens to every session and 2,421 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
goga-cell-python
Python rules for implementing CODEMANIFEST contracts.
python-run
Run and debug Python scripts in the project. Use when the user says "run python", "execute this script", "debug this py file", or wants to run/modify a .py file. Handles dependency checks, linting, execution, and error analysis.
goga-lang-disp
Detects the project language and dispatches execution to the matching language-specific skill. Apply this specification within the calling skill's context. Do not restate the contents — use them for decision-making.
FastAPI高性能API
A guide for building APIs with FastAPI, a Python framework for server-side web services.
Flask/Django分析器
A skill for analyzing Flask and Django, two Python web frameworks used to build websites and APIs.
Flask轻量级应用
A guide for building Flask applications, using a lightweight Python web framework for websites and APIs.